remcos | 8737cdfdcf2aa430ccfa6b2c1834a3c0768c201f4a77e3e5315e2bdbc3134a68

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
06/03/2021, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uitTYe3ZE5EMN3Z.exe
Size 317KB
Sample210306-5bbg51vavj
SHA256 8737cdfdcf2aa430ccfa6b2c1834a3c0768c201f4a77e3e5315e2bdbc3134a68
MD5 ceda33d4054ecb6658a9fc66d1717707
SHA1 3107d2f2f36c475ac73a187444b30b9e844ef153
SHA512 312c1952189db5c5ff38f76bd513e5cd7c6ba9518d546f66a502e7f868bb714f7a40daa26f0271fb724561bcb1292579b58a8f7e241aeac9e98fe7f562cb23a6
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

sandshoe.myfirewall.org:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1220	svchost.exe
1760	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchost.exe\""	uitTYe3ZE5EMN3Z.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchost.exe\""	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	uitTYe3ZE5EMN3Z.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 1220 set thread context of 1760	1220	svchost.exe	83
PID 1760 set thread context of 2064	1760	svchost.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	uitTYe3ZE5EMN3Z.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1760	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	svchost.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 4696 wrote to memory of 3136	4696	uitTYe3ZE5EMN3Z.exe	78
PID 3136 wrote to memory of 732	3136	uitTYe3ZE5EMN3Z.exe	79
PID 3136 wrote to memory of 732	3136	uitTYe3ZE5EMN3Z.exe	79
PID 3136 wrote to memory of 732	3136	uitTYe3ZE5EMN3Z.exe	79
PID 732 wrote to memory of 800	732	WScript.exe	80
PID 732 wrote to memory of 800	732	WScript.exe	80
PID 732 wrote to memory of 800	732	WScript.exe	80
PID 800 wrote to memory of 1220	800	cmd.exe	82
PID 800 wrote to memory of 1220	800	cmd.exe	82
PID 800 wrote to memory of 1220	800	cmd.exe	82
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1220 wrote to memory of 1760	1220	svchost.exe	83
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84
PID 1760 wrote to memory of 2064	1760	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\uitTYe3ZE5EMN3Z.exe
"C:\Users\Admin\AppData\Local\Temp\uitTYe3ZE5EMN3Z.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\uitTYe3ZE5EMN3Z.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1220
      - C:\Users\Admin\AppData\Roaming\Remcos\svchost.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-21-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/1220-27-0x0000000005401000-0x0000000005402000-memory.dmp

Download

memory/1760-36-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2064-34-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3136-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3136-16-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4696-5-0x0000000005470000-0x0000000005471000-memory.dmp

Download

memory/4696-6-0x0000000005010000-0x0000000005011000-memory.dmp

Download

memory/4696-2-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4696-10-0x0000000005450000-0x000000000545B000-memory.dmp

Download

memory/4696-11-0x0000000006C70000-0x0000000006CB6000-memory.dmp

Download

memory/4696-3-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/4696-7-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/4696-8-0x00000000051F0000-0x00000000051F1000-memory.dmp

Download

memory/4696-9-0x00000000085D0000-0x00000000085D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads